.editorconfig

+# http://editorconfig.org
+root = true
+
+[*.{yaml,yml}]
+end_of_line = lf
+indent_size = 2
+indent_style = space
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true

.gitignore

+.DS_Store
+._*
+*.iml
+.idea/
+dist/
+ci/submission-api.yaml
+spectral-rules/*
+!spectral-rules/.gitkeep

.gitlab-ci.yml

+.ssh-setup: &ssh-setup
+  - eval $(ssh-agent -s)
+  - echo "$CI_DEPLOYMENT_PRIVATE_KEY" | tr -d '\r' | ssh-add -
+  - echo "$UBERSPACE_KNOWN_HOST" >> ~/.ssh/known_hosts
+
+include:
+  - project: 'fit-connect/pipeline'
+    ref: main
+    file: 'workflows/no-duplicate-pipelines.gitlab-ci.yml'
+  - project: 'fit-connect/pipeline'
+    ref: main
+    file: 'reuse.gitlab-ci.yml'
+
+stages:
+  - build
+  - diff
+  - lint
+  - upload
+  - validate
+
+reuse:
+  extends: .reuse
+
+build:
+  stage: build
+  image: ${CI_REGISTRY}/fit-connect/images/baseimage:latest
+  script:
+    - redocly bundle spec/submission-api.yaml -o dist/submission-api.yaml
+  artifacts:
+    expose_as: 'Built API spec'
+    paths:
+      - dist/
+    expire_in: 1 day
+
+oas-diff-breaking:
+  stage: diff
+  image:
+    name: tufin/oasdiff
+    entrypoint: [ "" ]
+  script:
+    - oasdiff breaking --fail-on ERR --format junit https://schema.fitko.de/fit-connect/submission-api/latest/submission-api.yaml ./dist/submission-api.yaml | tee breaking.xml
+  artifacts:
+    when: always
+    paths:
+      - breaking.xml
+    reports:
+      junit: breaking.xml
+    expire_in: 1 day
+
+oas-diff-changelog:
+  stage: diff
+  image:
+    name: tufin/oasdiff
+    entrypoint: [ "" ]
+  script:
+    - oasdiff changelog --format html https://schema.fitko.de/fit-connect/submission-api/latest/submission-api.yaml ./dist/submission-api.yaml | tee changelog.html
+  artifacts:
+    expose_as: 'changelog'
+    when: always
+    paths:
+      - changelog.html
+    expire_in: 1 day
+
+lint-redocly:
+  stage: lint
+  image:
+    name: ${CI_REGISTRY}/fit-connect/images/baseimage:latest
+  script:
+    - redocly lint spec/submission-api.yaml
+
+lint-spectral:
+  stage: lint
+  image:
+    name: ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/stoplight/spectral:6.11.1 # v6.13.1 breaks spectral
+    entrypoint: [ "" ]
+  script:
+    - curl -s -L --fail-with-body --output "./spectral-rules/spectral-generic.yml" "https://github.com/italia/api-oas-checker-rules/releases/latest/download/spectral-generic.yml"
+    - curl -s -L --fail-with-body --output "./spectral-rules/spectral-security.yml" "https://github.com/italia/api-oas-checker-rules/releases/latest/download/spectral-security.yml"
+    - curl -s -L --fail-with-body --output "./spectral-rules/functions.zip" "https://github.com/italia/api-oas-checker-rules/releases/latest/download/functions.zip"
+    - unzip "./spectral-rules/functions.zip" -d "./spectral-rules/"
+    - mv "./spectral-rules/rulesets/functions" "./spectral-rules"
+    - spectral lint spec/submission-api.yaml --verbose --display-only-failures
+    - spectral lint dist/submission-api.yaml --verbose --display-only-failures
+
+variables:
+  DOCS_SERVER: fitko@dorado.uberspace.de
+  PREVIEW_LOCATION: preview.docs.fitko.dev/submission-api
+  LIVE_LOCATION: schema.fitko.de/fit-connect/submission-api
+
+upload-preview:
+  stage: upload
+  image: ${CI_REGISTRY}/fit-connect/images/baseimage:latest
+  environment:
+    name: review/$CI_COMMIT_REF_NAME
+    on_stop: stop-preview
+    auto_stop_in: 2 week
+    url: https://$PREVIEW_LOCATION/$CI_COMMIT_REF_SLUG/
+  rules:
+    - if: $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
+  before_script:
+    - *ssh-setup
+  script:
+    - ssh -o CheckHostIP=no $DOCS_SERVER mkdir -p $PREVIEW_LOCATION/$CI_COMMIT_REF_SLUG/
+    - rsync -Lvz -e "ssh -o CheckHostIP=no" ./ci/index.html            $DOCS_SERVER:$PREVIEW_LOCATION/$CI_COMMIT_REF_SLUG/
+    - rsync -Lvz -e "ssh -o CheckHostIP=no" ./ci/rapidoc.js            $DOCS_SERVER:$PREVIEW_LOCATION/$CI_COMMIT_REF_SLUG/
+    - rsync -Lvz -e "ssh -o CheckHostIP=no" ./dist/submission-api.yaml $DOCS_SERVER:$PREVIEW_LOCATION/$CI_COMMIT_REF_SLUG/
+
+link-check:
+  stage: validate
+  variables:
+    CRAWLER_URL: "https://schema.fitko.de/fit-connect/submission-api/"
+    CRAWLER_DOMAIN: "schema.fitko.de"
+    CRAWL_ONE_DOMAIN_ONLY: "yes"
+  trigger:
+    strategy: depend
+    project: fit-connect/schema-link-checker
+    branch: main
+
+upload-latest-dev:
+  stage: upload
+  image: ${CI_REGISTRY}/fit-connect/images/baseimage:latest
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+  before_script:
+    - *ssh-setup
+  script:
+    - sed -i "s,API_VERSION,latest-dev,g" dist/submission-api.yaml
+    - ssh -o CheckHostIP=no $DOCS_SERVER mkdir -p $LIVE_LOCATION/latest-dev/
+    - rsync -Lvz -e "ssh -o CheckHostIP=no" ./dist/submission-api.yaml $DOCS_SERVER:$LIVE_LOCATION/latest-dev/
+
+upload-release:
+  stage: upload
+  image: ${CI_REGISTRY}/fit-connect/images/baseimage:latest
+  rules:
+    - if: $CI_COMMIT_TAG
+  before_script:
+    - *ssh-setup
+  script:
+    - sed -i "s,API_VERSION,$CI_COMMIT_TAG,g" dist/submission-api.yaml
+
+    - ssh -o CheckHostIP=no $DOCS_SERVER mkdir -p $LIVE_LOCATION/$CI_COMMIT_TAG/
+    - rsync -Lvz -e "ssh -o CheckHostIP=no" ./dist/submission-api.yaml $DOCS_SERVER:$LIVE_LOCATION/$CI_COMMIT_TAG/
+
+    - ssh -o CheckHostIP=no $DOCS_SERVER mkdir -p $LIVE_LOCATION/latest/
+    - rsync -Lvz -e "ssh -o CheckHostIP=no" ./dist/submission-api.yaml $DOCS_SERVER:$LIVE_LOCATION/latest/
+
+stop-preview:
+  stage: .post
+  image: ${CI_REGISTRY}/fit-connect/images/baseimage:latest
+  environment:
+    name: review/$CI_COMMIT_REF_NAME
+    action: stop
+  needs:
+    - upload-preview
+  rules:
+    - if: $CI_MERGE_REQUEST_ID
+      when: manual
+  before_script:
+    - *ssh-setup
+  script:
+    - ssh $DOCS_SERVER "rm -rf $PREVIEW_LOCATION/$CI_COMMIT_REF_SLUG/"

.ignore

+# Ignorefile for ag / ripgrep
+ci/rapidoc.js

.mailmap

+Alexander Hoose <alexander.hoose@fitko.de> <59643077+PublicServiceGuy@users.noreply.github.com>
+Alexander Hoose <alexander.hoose@fitko.de> <Alexander.Hoose@fitko.de>
+Alexander Hoose <alexander.hoose@fitko.de> Alexander.Hoose@fitko.de
+Andreas Huber <andreas.huber@fjd.de> <60422538+fjd-anh@users.noreply.github.com>
+Andreas Huber <andreas.huber@fjd.de> <anh@fjd.de>
+Christoph Metzger <christoph.metzger_extern@fjd.de> <christoph.metzger@codecentric.de>
+David Schwarzmann <david.schwarzmann_extern@fjd.de> <david.schwarzmann@codecentric.de>
+Florian Kaufmann <florian.kaufmann_extern@fjd.de> <florian.kaufmann@codecentric.de>
+Jonas Groeger <jonas.groeger_extern@fjd.de> <jonas.groeger@codecentric.de>
+Jonas Groeger <jonas.groeger_extern@fjd.de> Jonas Gröger
+Marco Holz <marco.holz@fitko.de>
+Michael Haidner <michael@haidner.de> <haidner@live.de>
+Pascal Osterwinter <pascal.osterwinter@spotgroup.de> Pascal_Osterwinter
+Pascal Sochacki <pascal.sochacki_extern@fjd.de> <pascal.sochacki@codecentric.de>
+Unknown <nobody@invalid> fiep-poc <61742649+fiep-poc@users.noreply.github.com>
\ No newline at end of file

.reuse/dep5

+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+
+Files: ci/index.html spec/*.yaml
+       .editorconfig .gitignore .gitlab-ci.yml .ignore .mailmap .spectral.yml
+       CHANGELOG.md Makefile README.md redocly.yaml renovate.json
+       breaking.xml changelog.html
+Copyright: 2022- FIT-Connect contributors
+License: EUPL-1.2
+
+Files: ci/rapidoc.js
+Copyright: 2022 Mrinmoy Majumdar
+License: MIT

.spectral.yml

+extends:
+  - spectral:oas
+  - spectral-rules/spectral-generic.yml
+  - spectral-rules/spectral-security.yml
+
+rules:
+  # Broken rules (spectral crashes) in spectral-generic.yml
+  cache-responses-undocumented: off
+  cache-control-parameter-undocumented: off
+  servers-use-https: off
+  no-method-name-in-operationId: off
+
+  # Broken rules (spectral crashes) in spectral-security.yml
+  sec-array-boundaries: off
+  sec-number-boundaries: off
+  sec-no-additionalProperties: off
+  sec-no-default-additionalProperties: off
+  sec-constrained-additionalProperties: off
+  sec-securitySchemes-oauth: off
+  sec-securitySchemes-jwt: off
+  sec-string-maxlength: off
+  sec-string-pattern-or-format-or-enum: off
+
+  # API_VERSION is only set during release
+  use-semver: warn
+
+  # Disabled, since we don't want a /status endpoint.
+  # See https://git.fitko.de/fit-connect/api/-/merge_requests/37
+  paths-status: warn
+
+  # Our PATCH endpoints are not PATCH compliant
+  patch-media-type: warn
+
+  path-parameters-camelcase:
+    given: $..parameters[?(@.in == 'path')].name
+    then:
+      function: casing
+      functionOptions:
+        type: camel
+        disallowDigits: true
+    message: Path parameters should be camelCase and not contain digits
+    severity: error
+
+  query-parameters-camelcase:
+    given: $..parameters[?(@.in == 'query')].name
+    then:
+      function: casing
+      functionOptions:
+        type: camel
+        disallowDigits: true
+    message: Query parameters should be camelCase and not contain digits
+    severity: error

CHANGELOG.md

+<!--
+Types of changes:
+
+* Added: for new features.
+* Changed: for changes in existing functionality.
+* Deprecated: for soon-to-be removed features.
+* Dependencies: for changed / updated dependencies.
+* Removed: for now removed features.
+* Fixed: for any bug fixes.
+* Security: in case of vulnerabilities.
+
+Don’t forget to tag @ https://git.fitko.de/fit-connect/submission-api/-/tags
+-->
+
+# Submission API: Changelog
+
+* The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+* If available, include a ticket number in format `(planning#XXXX)`.
+
+## Unreleased
+
+## [1.14.0]
+
+### Added
+
+* Fügt die neuen Endpunkte `PUT /v1/cases/{caseId}/callback` und `DELETE /v1/cases/{caseId}/callback` hinzu ([planning#1668](https://git.fitko.de/fit-connect/planning/-/issues/1668)).
+
+## [1.13.0]
+
+### Added
+
+* Erweiterung des destination Schemas um `possibleNextStatus`, welches die aktuell möglichen nächsten Zustände des Zustellpunktes zurückgibt ([planning#287](https://git.fitko.de/fit-connect/planning/-/issues/287)).
+
+### Changed
+
+* Erweiterung des destination Schemas um `senderAccessRestricted`, d.h. um die Möglichkeit, das Senden an diesen Zustellpunkt nur bestimmten Sendern zu erlauben ([planning#2534](https://git.fitko.de/fit-connect/planning/-/issues/2534)).
+
+## [1.12.0]
+
+### Added
+
+- Erlaubt das Übertragen des optionalen Felds `region` bei `POST /v1/submissions`. Diese Erweiterung erlaubt es Anbindern,
+  den amtlichen Regionalschlüssel (ARS) zusätzlich zu übertragen. Das optionale Feld wird, falls gesetzt, entsprechend
+  auch bei `POST /v1/submissions`, `PUT /v1/submissions/{submissionId}` und `GET /v1/submissions/{submissionId}`
+  im Response-Body zurückgegeben ([planning#2515](https://git.fitko.de/fit-connect/planning/-/issues/2515)).
+
+## [1.11.0]
+
+### Added
+
+- Fügt die neuen Endpunkte `GET /v1/destinations/{destinationId}/limits` und `GET /v1/cases/{caseId}/limits` hinzu ([planning#2257](https://git.fitko.de/fit-connect/planning/-/issues/2257)).
+
+## [1.10.0]
+
+### Changed
+
+- `send:region:...`-OAuth-Scopes wurden durch `https://schema.fitko.de/fit-connect/oauth/scopes/send-submissions` -Scopes ersetzt ([planning#2415](https://git.fitko.de/fit-connect/planning/-/issues/2415)).
+
+### Added
+
+- Wir ergänzen die Pipeline um [oasdiff](https://github.com/Tufin/oasdiff), damit wir frühzeitig `breaking changes` in einer neuen API-Version erkennen und verhindern können ([planning#2381](https://git.fitko.de/fit-connect/planning/-/issues/2381))
+
+## [1.9.0]
+
+### Added
+
+- Die neuen Limits für gleichzeitige Up- und Downloads können zu einer HTTP 429 Response führen. Diese sind für die entsprechenden Endpunkte beschrieben worden ([planning#2166](https://git.fitko.de/fit-connect/planning/-/issues/2166))
+- Der Rückkanal DeutschlandID (`idBundDeMailbox`) wurde hinzugefügt.
+
+### Fixed
+
+- Im `error`-Schema wurden die bisher nicht dokumentierten Felder `errorcode`, `violations` und `issue` aufgenommen ([planning#2246](https://git.fitko.de/fit-connect/planning/-/issues/2246)).
+- In den Schemata `reply`, `destination-private` und `submission` wurde von `allOf` auf Inline-Properties umgestiegen.
+Dies stell keine inhaltliche Änderung dar, aber verbessert die Tooling-Unterstützung der Spezifikation ([planning#2246](https://git.fitko.de/fit-connect/planning/-/issues/2246)).
+- Das Feld `use` wird im JWK-Schema nun explizit aufgeführt, um eine strikte Übereinstimmung mit der Implementierung zu gewährleisten.
+Fachlich erfüllt das Feld jedoch keinen Zweck, da sein Wert immer `null` ist ([planning#2246](https://git.fitko.de/fit-connect/planning/-/issues/2246)).
+
+### Deprecated
+
+* Der Rückkanal "FINK" (`fink`) wurde abgekündigt (deprecated)
+
+## [1.8.0]
+
+### Fixed
+
+- Name der Destination wurde in Spezifikation aufgenommen (planning#2190)
+
+## [1.7.0]
+
+### Added
+
+* Neue Endpunkte zum Abruf des event logs für eine Einreichung bzw. für eine Antwort ([planning#2089](https://git.fitko.de/fit-connect/planning/-/issues/2089)):
+  * `get /v1/submissions/{submissionId}/events`
+  * `get /v1/replies/{replyId}/events`
+
+## [1.6.0]
+
+### Changed
+
+* Die Endpunkte unter "Internal" wurden entfernt. Analoge Endpunkte werden demnächst in einer separaten
+"Destination API" ausgewiesen ([planning#1788](https://git.fitko.de/fit-connect/planning/-/issues/1788)).
+* Kleinere Anpassungen wurden durchgeführt, um ein exaktes Übereinstimmen mit der Implementierung zu gewährleisten
+([planning#2041](https://git.fitko.de/fit-connect/planning/-/issues/2041)):
+  * Der Wert des `Cache-Control`-Headers wurde angepasst, um dem implementierten Verhalten zu entsprechen.
+  * Beim `/v1/replies/{replyId}/accept`-Endpunkt wurde die vergessene `HTTP 422`-Response hinzugefügt.
+  * `submission.encryptedData` und `submission.serviceType.description` sind nicht nur optionale Felder,
+  sondern sie können auch mit `null` übermittelt werden. Tatsächlich gibt der Zustelldienst diese auch explizit
+  als `null` zurück. Die Spezifikation wurde erweitert, um dieser feinen Unterscheidung Rechnung zu tragen.
+
+## [1.5.0]
+
+### Changed
+
+* Die Einträge unter `callbacks` wurden nach `webhooks` verschoben. Diese Änderung soll das tatsächliche Versenden
+von Benachrichtigungen verständlicher dokumentieren. ([planning#1850](https://git.fitko.de/fit-connect/planning/-/issues/1850))
+
+## [1.4.2]
+
+### Changed
+
+* Die Reihenfolge von Elementen in Listen-Endpunkten wird nun verbal klarer spezifiziert ([planning#1653](https://git.fitko.de/fit-connect/planning/-/issues/1653)).
+
+## [1.4.1]
+
+### Changed
+
+* Die `keyId` von `GET /v1/destinations/{destinationId}/keys/{keyId}` hat nun eine Länge von 8-64 Zeichen (zuvor 8-36). ([planning#1904](https://git.fitko.de/fit-connect/planning/-/issues/1904))
+* Das Feld `encryptionKid` einer Destination hat nun eine Minimallänge von 8 Zeichen.
+
+## [1.4.0]
+
+### Changed
+
+* Die Scopes `manage:destination:<id>` und `subscribe:destination:<id>` wurden umbenannt.
+  * `manage:destination:<id>` ➡ `https://schema.fitko.de/fit-connect/oauth/scopes/manage-destinations`
+  * `subscribe:destination:<id>` ➡ `https://schema.fitko.de/fit-connect/oauth/scopes/subscribe-destinations`
+  Die Autorisierungsprüfung wird nun nicht mehr über die IDs der Destinations im Token erledigt.
+  Für API-Clients ist diese Änderung transparent.
+  Die veränderten Scopes bei bestehenden API-Clients werden migriert.
+* [NO\_PUBLIC] Updated @redocly/cli to 1.10.x
+* [NO\_PUBLIC] Use FITKO GitLab docker registry. [(planning#1754)](https://git.fitko.de/fit-connect/planning/-/issues/1754)
+* [NO\_PUBLIC] The Submission API Specification is now bundled by [redocly-cli](https://redocly.com/docs/cli/) instead of swagger-cli (discontinued).
+  This should not affect the specification semantically but has changed the bundled document structure in certain aspects. [(planning#1409)](https://git.fitko.de/fit-connect/planning/-/issues/1409)
+* [NO\_PUBLIC] Updated RapiDoc to 9.3.4
+* Commits auf dem `main` Branch werden nun auf [latest-dev](https://schema.fitko.de/fit-connect/submission-api/latest-dev/) released. ([planning#1746](https://git.fitko.de/fit-connect/planning/-/issues/1746))
+* Releases werden nun, zusätzlich zum Pfad mit der Versionsnummer, auch auf [latest](https://schema.fitko.de/fit-connect/submission-api/latest) released. ([planning#1746](https://git.fitko.de/fit-connect/planning/-/issues/1746))
+* Duplizierte Schemadefinitionen wurden entfernt und sind jetzt im Format _dash-case_, also `create-reply` statt `CreateReply`.
+  Für API-Clients ist diese Änderung transparent, da sich das Verhalten der API sonst nicht ändert.
+  Codegeneratoren müssen eventuell angepasst werden.
+* Einführung des neuen Scopes `https://schema.fitko.de/fit-connect/oauth/scopes/read-all-event-logs`, um den Support zu verbessern ([planning#1745](https://git.fitko.de/fit-connect/planning/-/issues/1745))
+* Vereinheitlichung der Response-Bodies für die Erstellung und den Versand von Einreichungen (([planning#291](https://git.fitko.de/fit-connect/planning/-/issues/291)))
+  * `POST /v1/submissions` und `POST /v1/submissions/{submissionId}` geben nun einen einheitlichen Response-Body zurück.
+  * Auf die Übernahme des callback-Felds aus `submission-reduced` in das `submission-created`-Schema wurde verzichtet, da es bereits als deprecated markiert ist.
+
+## [1.3.0]
+
+### Added
+
+* The Submission API now has a new case management section since the bidirectional communication feature
+  adds more focus on cases. [(planning#460)](https://git.fitko.de/fit-connect/planning/-/issues/460)
+* The Submission API grew by two endpoints to retrieve a case / list all cases [(planning#460)](https://git.fitko.de/fit-connect/planning/-/issues/460):
+  * [`http get /v1/cases/<caseId>`](https://docs.fitko.de/fit-connect/docs/apis/submission-api?version=1.3.0#get-/v1/cases/-caseId-)
+  * [`http get /v1/cases`](https://docs.fitko.de/fit-connect/docs/apis/submission-api?version=1.3.0#get-/v1/cases)
+* The Submission API grew by several endpoints to manage / create / handle replies, a new top-level entity [(planning#460)](https://git.fitko.de/fit-connect/planning/-/issues/460):
+  * [`http get /v1/replies`](https://docs.fitko.de/fit-connect/docs/apis/submission-api?version=1.3.0#get-/v1/replies) to list replies
+  * [`http post /v1/replies`](https://docs.fitko.de/fit-connect/docs/apis/submission-api?version=1.3.0#post-/v1/replies) to create a reply
+  * [`http get /v1/replies/<replyId>`](https://docs.fitko.de/fit-connect/docs/apis/submission-api?version=1.3.0#get-/v1/replies/-replyId-) to get a specific reply
+  * [`http put /v1/replies/<replyId>`](https://docs.fitko.de/fit-connect/docs/apis/submission-api?version=1.3.0#put-/v1/replies/-replyId-) to submit a reply
+  * [`http put /v1/replies/<replyId>/accept`](https://docs.fitko.de/fit-connect/docs/apis/submission-api?version=1.3.0#put-/v1/replies/-replyId-/accept) to accept a reply (as an online service)
+  * [`http put /v1/replies/<replyId>/reject`](https://docs.fitko.de/fit-connect/docs/apis/submission-api?version=1.3.0#put-/v1/replies/-replyId-/reject) to reject a reply (as an online service)
+  * [`http get /v1/replies/<replyId>/attachments/<attachmentId>`](https://docs.fitko.de/fit-connect/docs/apis/submission-api?version=1.3.0#get-/v1/replies/-replyId-/attachments/-attachmentId-) to get a reply attachment
+  * [`http put /v1/replies/<replyId>/attachments/<attachmentId>`](https://docs.fitko.de/fit-connect/docs/apis/submission-api?version=1.3.0#put-/v1/replies/-replyId-/attachments/-attachmentId-) to upload a reply attachment
+* Similar to the [NewSubmissions callback](https://docs.fitko.de/fit-connect/docs/apis/submission-api?version=1.3.0#post-/v1/destinations),
+  the Submission API now has a [NewReplies callback](https://docs.fitko.de/fit-connect/docs/apis/submission-api?version=1.3.0#post-/v1/submissions) that gets called
+  every time a new reply is added to a case. [(planning#460)](https://git.fitko.de/fit-connect/planning/-/issues/460)
+* To enable bidirectional communication, an additional reply channel was added: `fitConnect`.
+  If a [destination supports](https://docs.fitko.de/fit-connect/docs/apis/submission-api?version=1.3.0#post-/v1/destinations) the `fitConnect` reply channel,
+  an [online service may select it via the Metadata `replyChannel -> fitConnect`](https://docs.fitko.de/fit-connect/docs/metadata/overview/).
+  For more details, check the [official FIT-Connect documentation](https://docs.fitko.de/fit-connect/docs/). [(planning#460)](https://git.fitko.de/fit-connect/planning/-/issues/460)
+
+### Changed
+
+* The Submission API now uses [OpenAPI 3.1.0](https://spec.openapis.org/oas/v3.1.0).
+* Consolidated Attachment and CreateAttachment entities to a common type JWE.
+  This might be relevant for code generation tools.
+  The content stays the same though.
+* Updated lots of descriptions and examples.
+  If you find more errors, please report them to [OpenCode](https://gitlab.opencode.de/fitko/feedback/-/issues).
+* The [NewEvents callback](https://docs.fitko.de/fit-connect/docs/apis/submission-api?version=1.3.0#post-/v1/destinations) may now include
+  a list of replies in the field `replies`. [(planning#460)](https://git.fitko.de/fit-connect/planning/-/issues/460)
+
+### Fixed
+
+* Only CORS requests receive CORS headers. [(planning#501)](https://git.fitko.de/fit-connect/planning/-/issues/501)
+
+## [1.2.1]
+
+* Baseline changelog.
+  Check GIT history for a changelog of this and earlier versions.

CODEOWNERS

-*	@fjd-anh

LICENSES/EUPL-1.2.txt

+EUROPEAN UNION PUBLIC LICENCE v. 1.2
+EUPL © the European Union 2007, 2016
+
+This European Union Public Licence (the ‘EUPL’) applies to the Work (as defined below) which is provided under the
+terms of this Licence. Any use of the Work, other than as authorised under this Licence is prohibited (to the extent such
+use is covered by a right of the copyright holder of the Work).
+The Work is provided under the terms of this Licence when the Licensor (as defined below) has placed the following
+notice immediately following the copyright notice for the Work:
+                          Licensed under the EUPL
+or has expressed by any other means his willingness to license under the EUPL.
+
+1.Definitions
+In this Licence, the following terms have the following meaning:
+— ‘The Licence’:this Licence.
+— ‘The Original Work’:the work or software distributed or communicated by the Licensor under this Licence, available
+as Source Code and also as Executable Code as the case may be.
+— ‘Derivative Works’:the works or software that could be created by the Licensee, based upon the Original Work or
+modifications thereof. This Licence does not define the extent of modification or dependence on the Original Work
+required in order to classify a work as a Derivative Work; this extent is determined by copyright law applicable in
+the country mentioned in Article 15.
+— ‘The Work’:the Original Work or its Derivative Works.
+— ‘The Source Code’:the human-readable form of the Work which is the most convenient for people to study and
+modify.
+— ‘The Executable Code’:any code which has generally been compiled and which is meant to be interpreted by
+a computer as a program.
+— ‘The Licensor’:the natural or legal person that distributes or communicates the Work under the Licence.
+— ‘Contributor(s)’:any natural or legal person who modifies the Work under the Licence, or otherwise contributes to
+the creation of a Derivative Work.
+— ‘The Licensee’ or ‘You’:any natural or legal person who makes any usage of the Work under the terms of the
+Licence.
+— ‘Distribution’ or ‘Communication’:any act of selling, giving, lending, renting, distributing, communicating,
+transmitting, or otherwise making available, online or offline, copies of the Work or providing access to its essential
+functionalities at the disposal of any other natural or legal person.
+
+2.Scope of the rights granted by the Licence
+The Licensor hereby grants You a worldwide, royalty-free, non-exclusive, sublicensable licence to do the following, for
+the duration of copyright vested in the Original Work:
+— use the Work in any circumstance and for all usage,
+— reproduce the Work,
+— modify the Work, and make Derivative Works based upon the Work,
+— communicate to the public, including the right to make available or display the Work or copies thereof to the public
+and perform publicly, as the case may be, the Work,
+— distribute the Work or copies thereof,
+— lend and rent the Work or copies thereof,
+— sublicense rights in the Work or copies thereof.
+Those rights can be exercised on any media, supports and formats, whether now known or later invented, as far as the
+applicable law permits so.
+In the countries where moral rights apply, the Licensor waives his right to exercise his moral right to the extent allowed
+by law in order to make effective the licence of the economic rights here above listed.
+The Licensor grants to the Licensee royalty-free, non-exclusive usage rights to any patents held by the Licensor, to the
+extent necessary to make use of the rights granted on the Work under this Licence.
+
+3.Communication of the Source Code
+The Licensor may provide the Work either in its Source Code form, or as Executable Code. If the Work is provided as
+Executable Code, the Licensor provides in addition a machine-readable copy of the Source Code of the Work along with
+each copy of the Work that the Licensor distributes or indicates, in a notice following the copyright notice attached to
+the Work, a repository where the Source Code is easily and freely accessible for as long as the Licensor continues to
+distribute or communicate the Work.
+
+4.Limitations on copyright
+Nothing in this Licence is intended to deprive the Licensee of the benefits from any exception or limitation to the
+exclusive rights of the rights owners in the Work, of the exhaustion of those rights or of other applicable limitations
+thereto.
+
+5.Obligations of the Licensee
+The grant of the rights mentioned above is subject to some restrictions and obligations imposed on the Licensee. Those
+obligations are the following:
+
+Attribution right: The Licensee shall keep intact all copyright, patent or trademarks notices and all notices that refer to
+the Licence and to the disclaimer of warranties. The Licensee must include a copy of such notices and a copy of the
+Licence with every copy of the Work he/she distributes or communicates. The Licensee must cause any Derivative Work
+to carry prominent notices stating that the Work has been modified and the date of modification.
+
+Copyleft clause: If the Licensee distributes or communicates copies of the Original Works or Derivative Works, this
+Distribution or Communication will be done under the terms of this Licence or of a later version of this Licence unless
+the Original Work is expressly distributed only under this version of the Licence — for example by communicating
+‘EUPL v. 1.2 only’. The Licensee (becoming Licensor) cannot offer or impose any additional terms or conditions on the
+Work or Derivative Work that alter or restrict the terms of the Licence.
+
+Compatibility clause: If the Licensee Distributes or Communicates Derivative Works or copies thereof based upon both
+the Work and another work licensed under a Compatible Licence, this Distribution or Communication can be done
+under the terms of this Compatible Licence. For the sake of this clause, ‘Compatible Licence’ refers to the licences listed
+in the appendix attached to this Licence. Should the Licensee's obligations under the Compatible Licence conflict with
+his/her obligations under this Licence, the obligations of the Compatible Licence shall prevail.
+
+Provision of Source Code: When distributing or communicating copies of the Work, the Licensee will provide
+a machine-readable copy of the Source Code or indicate a repository where this Source will be easily and freely available
+for as long as the Licensee continues to distribute or communicate the Work.
+Legal Protection: This Licence does not grant permission to use the trade names, trademarks, service marks, or names
+of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and
+reproducing the content of the copyright notice.
+
+6.Chain of Authorship
+The original Licensor warrants that the copyright in the Original Work granted hereunder is owned by him/her or
+licensed to him/her and that he/she has the power and authority to grant the Licence.
+Each Contributor warrants that the copyright in the modifications he/she brings to the Work are owned by him/her or
+licensed to him/her and that he/she has the power and authority to grant the Licence.
+Each time You accept the Licence, the original Licensor and subsequent Contributors grant You a licence to their contributions
+to the Work, under the terms of this Licence.
+
+7.Disclaimer of Warranty
+The Work is a work in progress, which is continuously improved by numerous Contributors. It is not a finished work
+and may therefore contain defects or ‘bugs’ inherent to this type of development.
+For the above reason, the Work is provided under the Licence on an ‘as is’ basis and without warranties of any kind
+concerning the Work, including without limitation merchantability, fitness for a particular purpose, absence of defects or
+errors, accuracy, non-infringement of intellectual property rights other than copyright as stated in Article 6 of this
+Licence.
+This disclaimer of warranty is an essential part of the Licence and a condition for the grant of any rights to the Work.
+
+8.Disclaimer of Liability
+Except in the cases of wilful misconduct or damages directly caused to natural persons, the Licensor will in no event be
+liable for any direct or indirect, material or moral, damages of any kind, arising out of the Licence or of the use of the
+Work, including without limitation, damages for loss of goodwill, work stoppage, computer failure or malfunction, loss
+of data or any commercial damage, even if the Licensor has been advised of the possibility of such damage. However,
+the Licensor will be liable under statutory product liability laws as far such laws apply to the Work.
+
+9.Additional agreements
+While distributing the Work, You may choose to conclude an additional agreement, defining obligations or services
+consistent with this Licence. However, if accepting obligations, You may act only on your own behalf and on your sole
+responsibility, not on behalf of the original Licensor or any other Contributor, and only if You agree to indemnify,
+defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against such Contributor by
+the fact You have accepted any warranty or additional liability.
+
+10.Acceptance of the Licence
+The provisions of this Licence can be accepted by clicking on an icon ‘I agree’ placed under the bottom of a window
+displaying the text of this Licence or by affirming consent in any other similar way, in accordance with the rules of
+applicable law. Clicking on that icon indicates your clear and irrevocable acceptance of this Licence and all of its terms
+and conditions.
+Similarly, you irrevocably accept this Licence and all of its terms and conditions by exercising any rights granted to You
+by Article 2 of this Licence, such as the use of the Work, the creation by You of a Derivative Work or the Distribution
+or Communication by You of the Work or copies thereof.
+
+11.Information to the public
+In case of any Distribution or Communication of the Work by means of electronic communication by You (for example,
+by offering to download the Work from a remote location) the distribution channel or media (for example, a website)
+must at least provide to the public the information requested by the applicable law regarding the Licensor, the Licence
+and the way it may be accessible, concluded, stored and reproduced by the Licensee.
+
+12.Termination of the Licence
+The Licence and the rights granted hereunder will terminate automatically upon any breach by the Licensee of the terms
+of the Licence.
+Such a termination will not terminate the licences of any person who has received the Work from the Licensee under
+the Licence, provided such persons remain in full compliance with the Licence.
+
+13.Miscellaneous
+Without prejudice of Article 9 above, the Licence represents the complete agreement between the Parties as to the
+Work.
+If any provision of the Licence is invalid or unenforceable under applicable law, this will not affect the validity or
+enforceability of the Licence as a whole. Such provision will be construed or reformed so as necessary to make it valid
+and enforceable.
+The European Commission may publish other linguistic versions or new versions of this Licence or updated versions of
+the Appendix, so far this is required and reasonable, without reducing the scope of the rights granted by the Licence.
+New versions of the Licence will be published with a unique version number.
+All linguistic versions of this Licence, approved by the European Commission, have identical value. Parties can take
+advantage of the linguistic version of their choice.
+
+14.Jurisdiction
+Without prejudice to specific agreement between parties,
+— any litigation resulting from the interpretation of this License, arising between the European Union institutions,
+bodies, offices or agencies, as a Licensor, and any Licensee, will be subject to the jurisdiction of the Court of Justice
+of the European Union, as laid down in article 272 of the Treaty on the Functioning of the European Union,
+— any litigation arising between other parties and resulting from the interpretation of this License, will be subject to
+the exclusive jurisdiction of the competent court where the Licensor resides or conducts its primary business.
+
+15.Applicable Law
+Without prejudice to specific agreement between parties,
+— this Licence shall be governed by the law of the European Union Member State where the Licensor has his seat,
+resides or has his registered office,
+— this licence shall be governed by Belgian law if the Licensor has no seat, residence or registered office inside
+a European Union Member State.
+
+
+                                                         Appendix
+
+‘Compatible Licences’ according to Article 5 EUPL are:
+— GNU General Public License (GPL) v. 2, v. 3
+— GNU Affero General Public License (AGPL) v. 3
+— Open Software License (OSL) v. 2.1, v. 3.0
+— Eclipse Public License (EPL) v. 1.0
+— CeCILL v. 2.0, v. 2.1
+— Mozilla Public Licence (MPL) v. 2
+— GNU Lesser General Public Licence (LGPL) v. 2.1, v. 3
+— Creative Commons Attribution-ShareAlike v. 3.0 Unported (CC BY-SA 3.0) for works other than software
+— European Union Public Licence (EUPL) v. 1.1, v. 1.2
+— Québec Free and Open-Source Licence — Reciprocity (LiLiQ-R) or Strong Reciprocity (LiLiQ-R+).
+
+The European Commission may update this Appendix to later versions of the above licences without producing
+a new version of the EUPL, as long as they provide the rights granted in Article 2 of this Licence and protect the
+covered Source Code from exclusive appropriation.
+All other changes or additions to this Appendix require the production of a new EUPL version.

LICENSES/MIT.txt

+MIT License
+
+Copyright (c) <year> <copyright holders>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Makefile

+.DEFAULT_GOAL := validate
+
+pwd := $(shell pwd)
+
+.PHONY: bundle
+bundle: backup
+	npx @redocly/cli@^1.10.6 bundle \
+		--output dist/submission-api.yaml spec/submission-api.yaml
+
+.PHONY: validate
+validate:
+	npx @redocly/cli@^1.10.6 lint spec/submission-api.yaml
+
+.PHONY: validate-build
+validate-build: bundle
+	npx @redocly/cli@^1.10.6 lint dist/submission-api.yaml
+
+.PHONY: bundle-dereferenced
+bundle-dereferenced: backup
+	npx @redocly/cli@^1.10.6 bundle \
+		--dereferenced --output dist/submission-api.yaml spec/submission-api.yaml
+
+.PHONY: backup
+backup:
+	if [ -f dist/submission-api.yaml ]; then cp dist/submission-api.yaml dist/submission-api-before.yaml; fi
+
+.PHONY: download-linting-rules
+download-linting-rules:
+	rm -r "./spectral-rules/functions" || true
+	rm -r "./spectral-rules/rulesets" || true
+	curl -s -L --fail-with-body --output "./spectral-rules/spectral-generic.yml" "https://github.com/italia/api-oas-checker-rules/releases/latest/download/spectral-generic.yml"
+	curl -s -L --fail-with-body --output "./spectral-rules/spectral-security.yml" "https://github.com/italia/api-oas-checker-rules/releases/latest/download/spectral-security.yml"
+	curl -s -L --fail-with-body --output "./spectral-rules/functions.zip" "https://github.com/italia/api-oas-checker-rules/releases/latest/download/functions.zip"
+	unzip "./spectral-rules/functions.zip" -d "./spectral-rules/"
+	mv "./spectral-rules/rulesets/functions" "./spectral-rules"
+
+.PHONY: spectral
+spectral: bundle download-linting-rules
+	docker run --rm --pull=always \
+		-v "$(pwd):/work" -w /work \
+		stoplight/spectral:6.11.1  lint spec/submission-api.yaml -D --verbose # v6.13.1 breaks spectral
+
+# oasdiff installation: curl -fsSL https://raw.githubusercontent.com/tufin/oasdiff/main/install.sh | sh
+
+.PHONY: oasdiff-breaking
+oasdiff-breaking: bundle
+	oasdiff breaking https://schema.fitko.de/fit-connect/submission-api/latest/submission-api.yaml ./dist/submission-api.yaml
+
+.PHONY: oasdiff-changelog
+oasdiff-changelog: bundle
+	oasdiff changelog https://schema.fitko.de/fit-connect/submission-api/latest/submission-api.yaml dist/submission-api.yaml

README.md

+# FIT-Connect API specification
+
+* Live Version: https://docs.fitko.de/fit-connect/docs/apis/submission-api
+
+## Rules
+
+### General
+
+- We use OpenAPI 3.1.0
+- The specification is written in YAML.
+- The specification adheres to [Semver](https://semver.org/).
+
+### Identifiers
+
+- Fields etc. are written in `camelCase`.
+- Short identifiers are written as `Id` and not `ID`.
+
+## "Magic" numbers
+
+- `683`: Minimum length of the modulus (`n`) of a JWK with a `4096` bit RSA key.
+  See https://git.fitko.de/fit-connect/submission-api/-/snippets/1.
+- `776`: Minimum length of a JWE in compact serialization. No payload. Content encryption with `A256GCM`. Key encryption
+  with `RSA-OAEP-256` and a `4096` bit RSA key.
+  See https://git.fitko.de/fit-connect/examples/-/blob/main/java/crypto/src/main/java/ExampleJweEncryption.java
+
+## Consistent identifiers
+
+To make the examples in `spec/examples` more consistent, we use the following fixed identifiers.
+Exceptions:
+
+* lists with several different IDs
+* examples that are semantically different
+
+If you use a new identifier, please make sure it differs in the first character since this makes it easier to read.
+
+| ID              | Value                                  |
+|-----------------|----------------------------------------|
+| `caseId`        | `e89e107e-ed79-40e6-ad34-4e770f9df263` |
+| `destinationId` | `879ee109-a690-4db8-ab32-424284184d7d` |
+| `submissionId`  | `ce75a6b8-d72f-4b94-b09e-af6be35bc2ae` |
+| `replyId`       | `b9715dcb-700e-44d9-802f-12b45bf9f8a3` |
+
+### Submission `ce75a6b8-d72f-4b94-b09e-af6be35bc2ae`
+
+Attachments:
+
+- `879ee109-a690-4db8-ab32-424284184d7d`
+- `2046f9f1-dc89-4440-9c24-c76a8f40d668`
+
+### Reply `b9715dcb-700e-44d9-802f-12b45bf9f8a3`
+
+Attachments:
+
+- `2d8cef0c-62e1-4936-925c-2da79377d29c`
+- `fa9e16fc-0cb1-4d14-9a9a-4130fa51083f`